CVE-2020-28374

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.10.7

Description The issue is related to insufficient identifier checking in the LIO SCSI target code, which can be exploited by remote attackers to read or write files via directory traversal in an XCOPY request. This can occur over a network if the attacker has access to one iSCSI LUN, allowing them to gain control over file access because I/O operations are proxied via an attacker-selected backstore.

Recommendations For Linux kernel versions prior to 5.10.7, update to version 5.10.7 or later to resolve the issue. As a temporary workaround, consider restricting access to the target core xcopy.c driver or disabling the XCOPY request functionality until a patch is available. Restrict access to iSCSI LUNs to minimize the risk of exploitation.